@carecard/jwt-read 1.0.0

package/dist/cjs/index.cjs

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./jwtLib"), exports);
+__exportStar(require("./jwtRoles"), exports);
+__exportStar(require("./types"), exports);

package/dist/cjs/index.d.ts

@@ -0,0 +1,3 @@
+export * from './jwtLib';
+export * from './jwtRoles';
+export * from './types';

package/dist/cjs/jwtLib.cjs

@@ -0,0 +1,393 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwtClientId = jwtClientId;
+exports.visitorClientId = visitorClientId;
+exports.doesJwtUserHasRole = doesJwtUserHasRole;
+exports.throwError = throwError;
+exports.isJwtExpired = isJwtExpired;
+exports.jwtAgeInMilliseconds = jwtAgeInMilliseconds;
+exports.validateAndExtractJwtObject = validateAndExtractJwtObject;
+exports.validateAndExtractWebToken = validateAndExtractWebToken;
+exports.validateAndExtractJwtObjectNoThrow = validateAndExtractJwtObjectNoThrow;
+exports.validateAndExtractWebTokenObjectNoThrow = validateAndExtractWebTokenObjectNoThrow;
+exports.validateAndExtractVisitorObjectNoThrow = validateAndExtractVisitorObjectNoThrow;
+exports.verifyJwtAndRole = verifyJwtAndRole;
+exports.verifyJwt = verifyJwt;
+exports.verifyWebToken = verifyWebToken;
+exports.verifyJwtNoThrow = verifyJwtNoThrow;
+exports.verifyWebTokenNoThrow = verifyWebTokenNoThrow;
+exports.verifyVisitorNoThrow = verifyVisitorNoThrow;
+exports.throwUsedTokenError = throwUsedTokenError;
+exports._isLoginRequired = _isLoginRequired;
+exports._extractJwtObject = _extractJwtObject;
+exports._extractJwtObjectNoThrow = _extractJwtObjectNoThrow;
+exports._extractVisitorObjectNoThrow = _extractVisitorObjectNoThrow;
+exports._isJwtSignatureValid = _isJwtSignatureValid;
+exports._isJwtSignatureValidNoThrow = _isJwtSignatureValidNoThrow;
+exports._validateJwt = _validateJwt;
+exports._validateWebToken = _validateWebToken;
+exports._validateJwtNoThrow = _validateJwtNoThrow;
+exports._validateWebTokenNoThrow = _validateWebTokenNoThrow;
+exports._validateVisitorNoThrow = _validateVisitorNoThrow;
+exports._extractJwt = _extractJwt;
+exports._extractWebToken = _extractWebToken;
+exports._extractJwtNoThrow = _extractJwtNoThrow;
+exports._extractWebTokenNoThrow = _extractWebTokenNoThrow;
+const validate = __importStar(require("@carecard/validate"));
+const jwtUtilAuth = __importStar(require("@carecard/auth-util"));
+const common_util_1 = require("@carecard/common-util");
+function jwtClientId(req) {
+    return req?.jwt?.payload?.client_id;
+}
+function visitorClientId(req) {
+    return req?.visitor?.payload?.client_id;
+}
+function doesJwtUserHasRole(req, userRole) {
+    if (userRole && typeof userRole === 'string') {
+        return req?.jwt?.payload?.roles?.includes(userRole);
+    }
+    else {
+        (0, common_util_1.throwNotAuthorizedError)();
+    }
+}
+function throwError(customErrorFunction) {
+    typeof customErrorFunction === 'function' ? customErrorFunction() : (0, common_util_1.throwLoginRequiredError)();
+}
+function isJwtExpired(req, jwtValiditySeconds) {
+    if (jwtValiditySeconds && typeof jwtValiditySeconds === 'number') {
+        return Math.abs(Math.round(jwtValiditySeconds)) * 1000 < jwtAgeInMilliseconds(req);
+    }
+    else {
+        return true;
+    }
+}
+function jwtAgeInMilliseconds(req) {
+    // Ensure req.jwt exists (create it if undefined)
+    req.jwt ?? (req.jwt = {
+        header: { alg: 'sha512', typ: 'JWT' }, // or a minimal placeholder
+        payload: { iat: 0, client_id: '', roles: [], email_not_confirmed: false },
+        age: Infinity,
+    });
+    const iat = req.jwt.payload?.iat;
+    const age = typeof iat === 'number' && iat > 0 ? Date.now() - iat : Infinity;
+    req.jwt.age = age;
+    return age;
+}
+async function validateAndExtractJwtObject(req, publicKey, customErrorFunction) {
+    const jwtString = await _validateJwt(req, customErrorFunction);
+    const isJwtSignatureValid = await _isJwtSignatureValid(jwtString, publicKey, customErrorFunction);
+    if (jwtString && isJwtSignatureValid) {
+        await _extractJwtObject(req, jwtString, customErrorFunction);
+    }
+    else {
+        req['jwt'] = null;
+        throwError(customErrorFunction);
+    }
+    return req;
+}
+async function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction) {
+    const webTokenString = await _validateWebToken(req, headerName, customErrorFunction);
+    const isJwtSignatureValid = await _isJwtSignatureValid(webTokenString, publicKey, customErrorFunction);
+    if (webTokenString && isJwtSignatureValid) {
+        await _extractJwtObject(req, webTokenString, customErrorFunction);
+    }
+    else {
+        req['jwt'] = null;
+        throwError(customErrorFunction);
+    }
+    return req;
+}
+async function validateAndExtractJwtObjectNoThrow(req, publicKey) {
+    try {
+        const jwtString = await _validateJwtNoThrow(req);
+        const isJwtSignatureValid = await _isJwtSignatureValidNoThrow(jwtString, publicKey);
+        if (jwtString && isJwtSignatureValid) {
+            await _extractJwtObjectNoThrow(req, jwtString);
+        }
+        else {
+            req['jwt'] = null;
+        }
+    }
+    catch (err) {
+        req['jwt'] = null;
+    }
+    return req;
+}
+async function validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName) {
+    try {
+        const jwtString = _validateWebTokenNoThrow(req, headerName);
+        const isJwtSignatureValid = await _isJwtSignatureValidNoThrow(jwtString, publicKey);
+        if (jwtString && isJwtSignatureValid) {
+            await _extractJwtObjectNoThrow(req, jwtString);
+        }
+        else {
+            req['jwt'] = null;
+        }
+    }
+    catch (err) {
+        req['jwt'] = null;
+    }
+    return req;
+}
+async function validateAndExtractVisitorObjectNoThrow(req, publicKey) {
+    try {
+        const jwtString = await _validateVisitorNoThrow(req);
+        const isJwtSignatureValid = await _isJwtSignatureValidNoThrow(jwtString, publicKey);
+        if (jwtString && isJwtSignatureValid) {
+            await _extractVisitorObjectNoThrow(req, jwtString);
+        }
+        else {
+            req['visitor'] = null;
+        }
+    }
+    catch (err) {
+        req['visitor'] = null;
+    }
+    return req;
+}
+function verifyJwtAndRole(role, publicKey, customErrorFunction) {
+    return async function (req, res, next) {
+        await validateAndExtractJwtObject(req, publicKey, customErrorFunction)
+            .then(req => doesJwtUserHasRole(req, role))
+            .then(isRoleExist => _isLoginRequired(isRoleExist, customErrorFunction))
+            .then(next)
+            .catch(next);
+    };
+}
+function verifyJwt(publicKey, customErrorFunction) {
+    return async function (req, res, next) {
+        await validateAndExtractJwtObject(req, publicKey, customErrorFunction)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+function verifyWebToken(publicKey, headerName, customErrorFunction) {
+    return async function (req, res, next) {
+        await validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+function verifyJwtNoThrow(publicKey) {
+    return async function (req, res, next) {
+        await validateAndExtractJwtObjectNoThrow(req, publicKey)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+function verifyWebTokenNoThrow(publicKey, headerName) {
+    return async function (req, res, next) {
+        await validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+function verifyVisitorNoThrow(publicKey) {
+    return async function (req, res, next) {
+        await validateAndExtractVisitorObjectNoThrow(req, publicKey)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+function throwUsedTokenError() {
+    throw new Error('Used_Token');
+}
+/*********************
+ * Private functions *
+ *********************/
+function _isLoginRequired(hasRequiredRole, customErrorFunction) {
+    if (!hasRequiredRole) {
+        throwError(customErrorFunction);
+    }
+}
+async function _extractJwtObject(req, jwt, customErrorFunction) {
+    if (jwt && typeof jwt === 'string') {
+        req['jwt'] = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+async function _extractJwtObjectNoThrow(req, jwt) {
+    if (jwt && typeof jwt === 'string') {
+        req['jwt'] = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
+    }
+    else {
+        req['jwt'] = null;
+    }
+}
+async function _extractVisitorObjectNoThrow(req, jwt) {
+    if (jwt && typeof jwt === 'string') {
+        req['visitor'] = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
+    }
+    else {
+        req['visitor'] = null;
+    }
+}
+async function _isJwtSignatureValid(jwt, publicKey, customErrorFunction) {
+    if (jwt && typeof jwt === 'string') {
+        return jwtUtilAuth.verifyJwtSignature(jwt, publicKey);
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+async function _isJwtSignatureValidNoThrow(jwt, publicKey) {
+    if (jwt && typeof jwt === 'string') {
+        return jwtUtilAuth.verifyJwtSignature(jwt, publicKey);
+    }
+    else {
+        return false;
+    }
+}
+async function _validateJwt(req, customErrorFunction) {
+    // Get from http header.
+    let jwtRaw = req.get('Authorization');
+    // Extract jwt from bearer schema.
+    let jwt = _extractJwt(jwtRaw, customErrorFunction);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(jwt || '')) {
+        return jwt;
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+async function _validateWebToken(req, headerName, customErrorFunction) {
+    // Get from http header.
+    let jwtRaw = req.get(headerName);
+    // Extract jwt from bearer schema.
+    let webToken = _extractWebToken(jwtRaw, customErrorFunction);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(webToken || '')) {
+        return webToken;
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+function _validateJwtNoThrow(req) {
+    // Get from http header.
+    let jwtRaw = req.get('Authorization');
+    if (!jwtRaw) {
+        return null;
+    }
+    // Extract jwt from bearer schema.
+    let jwt = _extractJwtNoThrow(jwtRaw);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(jwt || '')) {
+        return jwt;
+    }
+    return null;
+}
+function _validateWebTokenNoThrow(req, headerName) {
+    // Get from http header.
+    let jwtRaw = req.get(headerName);
+    if (!jwtRaw) {
+        return null;
+    }
+    // Extract jwt from bearer schema.
+    let webToken = _extractWebTokenNoThrow(jwtRaw);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(webToken || '')) {
+        return webToken;
+    }
+    return null;
+}
+function _validateVisitorNoThrow(req) {
+    // Get from http header.
+    let jwtRaw = req.get('Visitor');
+    if (!jwtRaw) {
+        return null;
+    }
+    // Extract jwt from bearer schema.
+    let jwt = _extractJwtNoThrow(jwtRaw);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(jwt || '')) {
+        return jwt;
+    }
+    return null;
+}
+function _extractJwt(jwtRaw, customErrorFunction) {
+    let jwtSplit = null;
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        jwtSplit = jwtRaw.split(' ');
+    }
+    else {
+        throwError(customErrorFunction);
+        return null;
+    }
+    // Guard before indexing
+    if (!jwtSplit || jwtSplit.length < 2) {
+        throwError(customErrorFunction);
+        return null;
+    }
+    if (jwtSplit[0].toLowerCase() === 'bearer') {
+        return jwtSplit[1] ?? null;
+    }
+    else {
+        throwError(customErrorFunction);
+        return null;
+    }
+}
+function _extractWebToken(jwtRaw, customErrorFunction) {
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        return jwtRaw;
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+    return null;
+}
+function _extractJwtNoThrow(jwtRaw) {
+    let jwtSplit = null;
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        jwtSplit = jwtRaw.split(' ');
+    }
+    else {
+        return null;
+    }
+    if (jwtSplit[0]?.toLowerCase() === 'bearer') {
+        return jwtSplit[1];
+    }
+    return null;
+}
+function _extractWebTokenNoThrow(jwtRaw) {
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        return jwtRaw;
+    }
+    return null;
+}

package/dist/cjs/jwtLib.d.ts

@@ -0,0 +1,38 @@
+import type { Response, NextFunction } from 'express';
+import { RequestWithJWToken, Role } from './types';
+export declare function jwtClientId(req: RequestWithJWToken): string | undefined;
+export declare function visitorClientId(req: RequestWithJWToken): string | undefined;
+export declare function doesJwtUserHasRole(req: RequestWithJWToken, userRole: Role): boolean | undefined;
+export declare function throwError(customErrorFunction?: any): void;
+export declare function isJwtExpired(req: RequestWithJWToken, jwtValiditySeconds: number): boolean;
+export declare function jwtAgeInMilliseconds(req: RequestWithJWToken): number;
+export declare function validateAndExtractJwtObject(req: RequestWithJWToken, publicKey: string, customErrorFunction?: any): Promise<any>;
+export declare function validateAndExtractWebToken(req: RequestWithJWToken, publicKey: string, headerName: string, customErrorFunction?: any): Promise<any>;
+export declare function validateAndExtractJwtObjectNoThrow(req: RequestWithJWToken, publicKey: string): Promise<any>;
+export declare function validateAndExtractWebTokenObjectNoThrow(req: RequestWithJWToken, publicKey: string, headerName: string): Promise<any>;
+export declare function validateAndExtractVisitorObjectNoThrow(req: RequestWithJWToken, publicKey: string): Promise<any>;
+export declare function verifyJwtAndRole(role: Role, publicKey: string, customErrorFunction?: any): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<any>;
+export declare function verifyJwt(publicKey: string, customErrorFunction?: any): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<any>;
+export declare function verifyWebToken(publicKey: string, headerName: string, customErrorFunction?: any): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<any>;
+export declare function verifyJwtNoThrow(publicKey: string): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<void>;
+export declare function verifyWebTokenNoThrow(publicKey: string, headerName: string): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<void>;
+export declare function verifyVisitorNoThrow(publicKey: string): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<void>;
+export declare function throwUsedTokenError(): void;
+/*********************
+ * Private functions *
+ *********************/
+export declare function _isLoginRequired(hasRequiredRole: boolean | undefined, customErrorFunction?: any): void;
+export declare function _extractJwtObject(req: RequestWithJWToken, jwt: string, customErrorFunction?: any): Promise<any>;
+export declare function _extractJwtObjectNoThrow(req: RequestWithJWToken, jwt: string): Promise<any>;
+export declare function _extractVisitorObjectNoThrow(req: RequestWithJWToken, jwt: string): Promise<any>;
+export declare function _isJwtSignatureValid(jwt: string, publicKey: string, customErrorFunction?: any): Promise<any>;
+export declare function _isJwtSignatureValidNoThrow(jwt: string | null, publicKey: string): Promise<any>;
+export declare function _validateJwt(req: RequestWithJWToken, customErrorFunction?: any): Promise<any>;
+export declare function _validateWebToken(req: RequestWithJWToken, headerName: string, customErrorFunction?: any): Promise<any>;
+export declare function _validateJwtNoThrow(req: RequestWithJWToken): string | null;
+export declare function _validateWebTokenNoThrow(req: RequestWithJWToken, headerName: string): string | null;
+export declare function _validateVisitorNoThrow(req: RequestWithJWToken): string | null;
+export declare function _extractJwt(jwtRaw: string | undefined, customErrorFunction?: (msg?: string) => never | void): string | null;
+export declare function _extractWebToken(jwtRaw: string | undefined, customErrorFunction?: any): string | null;
+export declare function _extractJwtNoThrow(jwtRaw: string): string | null;
+export declare function _extractWebTokenNoThrow(jwtRaw: string): string | null;

package/dist/cjs/jwtRoles.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getNameOfRoleFromCode = getNameOfRoleFromCode;
+exports.getCodeFromNameOfRole = getCodeFromNameOfRole;
+const codesToCategory = {
+    ad: 'admin',
+    su: 'super_admin',
+};
+function getNameOfRoleFromCode(roleCode) {
+    // Cast only at index, use nullish coalescing for fallback
+    return codesToCategory[roleCode] ?? '';
+}
+const namesToCode = {
+    admin: 'ad',
+    super_admin: 'su',
+};
+function getCodeFromNameOfRole(roleName) {
+    return namesToCode[roleName] ?? '';
+}

package/dist/cjs/jwtRoles.d.ts

@@ -0,0 +1,2 @@
+export declare function getNameOfRoleFromCode(roleCode: string): string;
+export declare function getCodeFromNameOfRole(roleName: string): string;

package/dist/cjs/types.cjs

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types.d.ts

@@ -0,0 +1,25 @@
+import type { Request } from 'express';
+export interface JwtHeader {
+    alg: string;
+    typ: string;
+}
+export type Role = string;
+export type Roles = Role[];
+export interface JwtPayload {
+    /** Issued-at timestamp */
+    iat: number;
+    /** Client identifier (UUID as string) */
+    client_id: string;
+    roles: Roles;
+    email_not_confirmed: boolean;
+}
+export interface JWToken {
+    header: JwtHeader;
+    payload: JwtPayload;
+    /** Age in milliseconds (number) */
+    age: number;
+}
+export interface RequestWithJWToken extends Request {
+    jwt?: JWToken | null | undefined;
+    visitor?: JWToken | null | undefined;
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,3 @@
+export * from './jwtLib';
+export * from './jwtRoles';
+export * from './types';

package/dist/esm/index.js

@@ -0,0 +1,3 @@
+export * from './jwtLib';
+export * from './jwtRoles';
+export * from './types';

package/dist/esm/jwtLib.d.ts

@@ -0,0 +1,38 @@
+import type { Response, NextFunction } from 'express';
+import { RequestWithJWToken, Role } from './types';
+export declare function jwtClientId(req: RequestWithJWToken): string | undefined;
+export declare function visitorClientId(req: RequestWithJWToken): string | undefined;
+export declare function doesJwtUserHasRole(req: RequestWithJWToken, userRole: Role): boolean | undefined;
+export declare function throwError(customErrorFunction?: any): void;
+export declare function isJwtExpired(req: RequestWithJWToken, jwtValiditySeconds: number): boolean;
+export declare function jwtAgeInMilliseconds(req: RequestWithJWToken): number;
+export declare function validateAndExtractJwtObject(req: RequestWithJWToken, publicKey: string, customErrorFunction?: any): Promise<any>;
+export declare function validateAndExtractWebToken(req: RequestWithJWToken, publicKey: string, headerName: string, customErrorFunction?: any): Promise<any>;
+export declare function validateAndExtractJwtObjectNoThrow(req: RequestWithJWToken, publicKey: string): Promise<any>;
+export declare function validateAndExtractWebTokenObjectNoThrow(req: RequestWithJWToken, publicKey: string, headerName: string): Promise<any>;
+export declare function validateAndExtractVisitorObjectNoThrow(req: RequestWithJWToken, publicKey: string): Promise<any>;
+export declare function verifyJwtAndRole(role: Role, publicKey: string, customErrorFunction?: any): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<any>;
+export declare function verifyJwt(publicKey: string, customErrorFunction?: any): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<any>;
+export declare function verifyWebToken(publicKey: string, headerName: string, customErrorFunction?: any): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<any>;
+export declare function verifyJwtNoThrow(publicKey: string): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<void>;
+export declare function verifyWebTokenNoThrow(publicKey: string, headerName: string): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<void>;
+export declare function verifyVisitorNoThrow(publicKey: string): (req: RequestWithJWToken, res: Response, next: NextFunction) => Promise<void>;
+export declare function throwUsedTokenError(): void;
+/*********************
+ * Private functions *
+ *********************/
+export declare function _isLoginRequired(hasRequiredRole: boolean | undefined, customErrorFunction?: any): void;
+export declare function _extractJwtObject(req: RequestWithJWToken, jwt: string, customErrorFunction?: any): Promise<any>;
+export declare function _extractJwtObjectNoThrow(req: RequestWithJWToken, jwt: string): Promise<any>;
+export declare function _extractVisitorObjectNoThrow(req: RequestWithJWToken, jwt: string): Promise<any>;
+export declare function _isJwtSignatureValid(jwt: string, publicKey: string, customErrorFunction?: any): Promise<any>;
+export declare function _isJwtSignatureValidNoThrow(jwt: string | null, publicKey: string): Promise<any>;
+export declare function _validateJwt(req: RequestWithJWToken, customErrorFunction?: any): Promise<any>;
+export declare function _validateWebToken(req: RequestWithJWToken, headerName: string, customErrorFunction?: any): Promise<any>;
+export declare function _validateJwtNoThrow(req: RequestWithJWToken): string | null;
+export declare function _validateWebTokenNoThrow(req: RequestWithJWToken, headerName: string): string | null;
+export declare function _validateVisitorNoThrow(req: RequestWithJWToken): string | null;
+export declare function _extractJwt(jwtRaw: string | undefined, customErrorFunction?: (msg?: string) => never | void): string | null;
+export declare function _extractWebToken(jwtRaw: string | undefined, customErrorFunction?: any): string | null;
+export declare function _extractJwtNoThrow(jwtRaw: string): string | null;
+export declare function _extractWebTokenNoThrow(jwtRaw: string): string | null;

package/dist/esm/jwtLib.js

@@ -0,0 +1,325 @@
+import * as validate from '@carecard/validate';
+import * as jwtUtilAuth from '@carecard/auth-util';
+import { throwLoginRequiredError, throwNotAuthorizedError } from '@carecard/common-util';
+export function jwtClientId(req) {
+    return req?.jwt?.payload?.client_id;
+}
+export function visitorClientId(req) {
+    return req?.visitor?.payload?.client_id;
+}
+export function doesJwtUserHasRole(req, userRole) {
+    if (userRole && typeof userRole === 'string') {
+        return req?.jwt?.payload?.roles?.includes(userRole);
+    }
+    else {
+        throwNotAuthorizedError();
+    }
+}
+export function throwError(customErrorFunction) {
+    typeof customErrorFunction === 'function' ? customErrorFunction() : throwLoginRequiredError();
+}
+export function isJwtExpired(req, jwtValiditySeconds) {
+    if (jwtValiditySeconds && typeof jwtValiditySeconds === 'number') {
+        return Math.abs(Math.round(jwtValiditySeconds)) * 1000 < jwtAgeInMilliseconds(req);
+    }
+    else {
+        return true;
+    }
+}
+export function jwtAgeInMilliseconds(req) {
+    // Ensure req.jwt exists (create it if undefined)
+    req.jwt ?? (req.jwt = {
+        header: { alg: 'sha512', typ: 'JWT' }, // or a minimal placeholder
+        payload: { iat: 0, client_id: '', roles: [], email_not_confirmed: false },
+        age: Infinity,
+    });
+    const iat = req.jwt.payload?.iat;
+    const age = typeof iat === 'number' && iat > 0 ? Date.now() - iat : Infinity;
+    req.jwt.age = age;
+    return age;
+}
+export async function validateAndExtractJwtObject(req, publicKey, customErrorFunction) {
+    const jwtString = await _validateJwt(req, customErrorFunction);
+    const isJwtSignatureValid = await _isJwtSignatureValid(jwtString, publicKey, customErrorFunction);
+    if (jwtString && isJwtSignatureValid) {
+        await _extractJwtObject(req, jwtString, customErrorFunction);
+    }
+    else {
+        req['jwt'] = null;
+        throwError(customErrorFunction);
+    }
+    return req;
+}
+export async function validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction) {
+    const webTokenString = await _validateWebToken(req, headerName, customErrorFunction);
+    const isJwtSignatureValid = await _isJwtSignatureValid(webTokenString, publicKey, customErrorFunction);
+    if (webTokenString && isJwtSignatureValid) {
+        await _extractJwtObject(req, webTokenString, customErrorFunction);
+    }
+    else {
+        req['jwt'] = null;
+        throwError(customErrorFunction);
+    }
+    return req;
+}
+export async function validateAndExtractJwtObjectNoThrow(req, publicKey) {
+    try {
+        const jwtString = await _validateJwtNoThrow(req);
+        const isJwtSignatureValid = await _isJwtSignatureValidNoThrow(jwtString, publicKey);
+        if (jwtString && isJwtSignatureValid) {
+            await _extractJwtObjectNoThrow(req, jwtString);
+        }
+        else {
+            req['jwt'] = null;
+        }
+    }
+    catch (err) {
+        req['jwt'] = null;
+    }
+    return req;
+}
+export async function validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName) {
+    try {
+        const jwtString = _validateWebTokenNoThrow(req, headerName);
+        const isJwtSignatureValid = await _isJwtSignatureValidNoThrow(jwtString, publicKey);
+        if (jwtString && isJwtSignatureValid) {
+            await _extractJwtObjectNoThrow(req, jwtString);
+        }
+        else {
+            req['jwt'] = null;
+        }
+    }
+    catch (err) {
+        req['jwt'] = null;
+    }
+    return req;
+}
+export async function validateAndExtractVisitorObjectNoThrow(req, publicKey) {
+    try {
+        const jwtString = await _validateVisitorNoThrow(req);
+        const isJwtSignatureValid = await _isJwtSignatureValidNoThrow(jwtString, publicKey);
+        if (jwtString && isJwtSignatureValid) {
+            await _extractVisitorObjectNoThrow(req, jwtString);
+        }
+        else {
+            req['visitor'] = null;
+        }
+    }
+    catch (err) {
+        req['visitor'] = null;
+    }
+    return req;
+}
+export function verifyJwtAndRole(role, publicKey, customErrorFunction) {
+    return async function (req, res, next) {
+        await validateAndExtractJwtObject(req, publicKey, customErrorFunction)
+            .then(req => doesJwtUserHasRole(req, role))
+            .then(isRoleExist => _isLoginRequired(isRoleExist, customErrorFunction))
+            .then(next)
+            .catch(next);
+    };
+}
+export function verifyJwt(publicKey, customErrorFunction) {
+    return async function (req, res, next) {
+        await validateAndExtractJwtObject(req, publicKey, customErrorFunction)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+export function verifyWebToken(publicKey, headerName, customErrorFunction) {
+    return async function (req, res, next) {
+        await validateAndExtractWebToken(req, publicKey, headerName, customErrorFunction)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+export function verifyJwtNoThrow(publicKey) {
+    return async function (req, res, next) {
+        await validateAndExtractJwtObjectNoThrow(req, publicKey)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+export function verifyWebTokenNoThrow(publicKey, headerName) {
+    return async function (req, res, next) {
+        await validateAndExtractWebTokenObjectNoThrow(req, publicKey, headerName)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+export function verifyVisitorNoThrow(publicKey) {
+    return async function (req, res, next) {
+        await validateAndExtractVisitorObjectNoThrow(req, publicKey)
+            .then(() => process.nextTick(next))
+            .catch(next);
+    };
+}
+export function throwUsedTokenError() {
+    throw new Error('Used_Token');
+}
+/*********************
+ * Private functions *
+ *********************/
+export function _isLoginRequired(hasRequiredRole, customErrorFunction) {
+    if (!hasRequiredRole) {
+        throwError(customErrorFunction);
+    }
+}
+export async function _extractJwtObject(req, jwt, customErrorFunction) {
+    if (jwt && typeof jwt === 'string') {
+        req['jwt'] = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+export async function _extractJwtObjectNoThrow(req, jwt) {
+    if (jwt && typeof jwt === 'string') {
+        req['jwt'] = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
+    }
+    else {
+        req['jwt'] = null;
+    }
+}
+export async function _extractVisitorObjectNoThrow(req, jwt) {
+    if (jwt && typeof jwt === 'string') {
+        req['visitor'] = jwtUtilAuth.getHeaderPayloadFromJwt(jwt);
+    }
+    else {
+        req['visitor'] = null;
+    }
+}
+export async function _isJwtSignatureValid(jwt, publicKey, customErrorFunction) {
+    if (jwt && typeof jwt === 'string') {
+        return jwtUtilAuth.verifyJwtSignature(jwt, publicKey);
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+export async function _isJwtSignatureValidNoThrow(jwt, publicKey) {
+    if (jwt && typeof jwt === 'string') {
+        return jwtUtilAuth.verifyJwtSignature(jwt, publicKey);
+    }
+    else {
+        return false;
+    }
+}
+export async function _validateJwt(req, customErrorFunction) {
+    // Get from http header.
+    let jwtRaw = req.get('Authorization');
+    // Extract jwt from bearer schema.
+    let jwt = _extractJwt(jwtRaw, customErrorFunction);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(jwt || '')) {
+        return jwt;
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+export async function _validateWebToken(req, headerName, customErrorFunction) {
+    // Get from http header.
+    let jwtRaw = req.get(headerName);
+    // Extract jwt from bearer schema.
+    let webToken = _extractWebToken(jwtRaw, customErrorFunction);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(webToken || '')) {
+        return webToken;
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+}
+export function _validateJwtNoThrow(req) {
+    // Get from http header.
+    let jwtRaw = req.get('Authorization');
+    if (!jwtRaw) {
+        return null;
+    }
+    // Extract jwt from bearer schema.
+    let jwt = _extractJwtNoThrow(jwtRaw);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(jwt || '')) {
+        return jwt;
+    }
+    return null;
+}
+export function _validateWebTokenNoThrow(req, headerName) {
+    // Get from http header.
+    let jwtRaw = req.get(headerName);
+    if (!jwtRaw) {
+        return null;
+    }
+    // Extract jwt from bearer schema.
+    let webToken = _extractWebTokenNoThrow(jwtRaw);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(webToken || '')) {
+        return webToken;
+    }
+    return null;
+}
+export function _validateVisitorNoThrow(req) {
+    // Get from http header.
+    let jwtRaw = req.get('Visitor');
+    if (!jwtRaw) {
+        return null;
+    }
+    // Extract jwt from bearer schema.
+    let jwt = _extractJwtNoThrow(jwtRaw);
+    // Validate characters string of jwt.
+    if (validate.isJwtString(jwt || '')) {
+        return jwt;
+    }
+    return null;
+}
+export function _extractJwt(jwtRaw, customErrorFunction) {
+    let jwtSplit = null;
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        jwtSplit = jwtRaw.split(' ');
+    }
+    else {
+        throwError(customErrorFunction);
+        return null;
+    }
+    // Guard before indexing
+    if (!jwtSplit || jwtSplit.length < 2) {
+        throwError(customErrorFunction);
+        return null;
+    }
+    if (jwtSplit[0].toLowerCase() === 'bearer') {
+        return jwtSplit[1] ?? null;
+    }
+    else {
+        throwError(customErrorFunction);
+        return null;
+    }
+}
+export function _extractWebToken(jwtRaw, customErrorFunction) {
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        return jwtRaw;
+    }
+    else {
+        throwError(customErrorFunction);
+    }
+    return null;
+}
+export function _extractJwtNoThrow(jwtRaw) {
+    let jwtSplit = null;
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        jwtSplit = jwtRaw.split(' ');
+    }
+    else {
+        return null;
+    }
+    if (jwtSplit[0]?.toLowerCase() === 'bearer') {
+        return jwtSplit[1];
+    }
+    return null;
+}
+export function _extractWebTokenNoThrow(jwtRaw) {
+    if (jwtRaw && typeof jwtRaw === 'string') {
+        return jwtRaw;
+    }
+    return null;
+}

package/dist/esm/jwtRoles.d.ts

@@ -0,0 +1,2 @@
+export declare function getNameOfRoleFromCode(roleCode: string): string;
+export declare function getCodeFromNameOfRole(roleName: string): string;

package/dist/esm/jwtRoles.js

@@ -0,0 +1,15 @@
+const codesToCategory = {
+    ad: 'admin',
+    su: 'super_admin',
+};
+export function getNameOfRoleFromCode(roleCode) {
+    // Cast only at index, use nullish coalescing for fallback
+    return codesToCategory[roleCode] ?? '';
+}
+const namesToCode = {
+    admin: 'ad',
+    super_admin: 'su',
+};
+export function getCodeFromNameOfRole(roleName) {
+    return namesToCode[roleName] ?? '';
+}

package/dist/esm/types.d.ts

@@ -0,0 +1,25 @@
+import type { Request } from 'express';
+export interface JwtHeader {
+    alg: string;
+    typ: string;
+}
+export type Role = string;
+export type Roles = Role[];
+export interface JwtPayload {
+    /** Issued-at timestamp */
+    iat: number;
+    /** Client identifier (UUID as string) */
+    client_id: string;
+    roles: Roles;
+    email_not_confirmed: boolean;
+}
+export interface JWToken {
+    header: JwtHeader;
+    payload: JwtPayload;
+    /** Age in milliseconds (number) */
+    age: number;
+}
+export interface RequestWithJWToken extends Request {
+    jwt?: JWToken | null | undefined;
+    visitor?: JWToken | null | undefined;
+}

package/dist/esm/types.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@carecard/jwt-read",
+  "version": "1.0.0",
+  "private": false,
+  "description": "Jwt read functions",
+  "license": "ISC",
+  "author": "PK Singh",
+  "repository": {
+    "type": "git",
+    "url": "git+https:github.com/CareCard-ca/pkg-jwt-read.git"
+  },
+  "keywords": [
+    "auth",
+    "utility",
+    "cryptology"
+  ],
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/cjs/index.cjs",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.cjs",
+      "types": "./dist/esm/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "npm run build:esm && npm run build:cjs",
+    "build:esm": "tsc -p tsconfig.esm.json",
+    "build:cjs": "tsc -p tsconfig.cjs.json && node ./scripts/rename-cjs.js",
+    "test": "NODE_NO_WARNINGS=1 jest --coverage",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "lint": "eslint",
+    "prepare": "husky"
+  },
+  "devDependencies": {
+    "@types/express": "5.0.6",
+    "@types/jest": "30.0.0",
+    "eslint": "9.39.2",
+    "husky": "9.1.7",
+    "jest": "30.2.0",
+    "prettier": "3.7.4",
+    "ts-jest": "29.4.6",
+    "typescript": "5.9.3",
+    "typescript-eslint": "8.50.1"
+  },
+  "dependencies": {
+    "@carecard/auth-util": "1.0.1",
+    "@carecard/common-util": "1.0.1",
+    "@carecard/validate": "1.0.1",
+    "express": "5.2.1"
+  }
+}

package/readme.md

@@ -0,0 +1,30 @@
+# Jwt read utility
+
+## Main Functionality
+
+This is a collection of jwt reading functions.
+
+### Main functions
+
+```js
+const jwtReader = require( '@carecard/jwt-read' );
+```
+
+Read jwt
+
+```js
+const jwtMiddleware = jwtReader.verifyJwtAndRole( "admin", publicKey, jwtReader.throwUsedTokenError );
+await jwtMiddleware( req, res, next );
+```
+
+Following the above ```req.jwt``` contains
+
+```js
+{
+    header: {
+    alg: ''
+    }
+    payload: {
+    }
+}
+```